Intermittent internet access

[altis]

Now, this is doin' my 'ead in!!!

After an irepairable motherboard failure I've recently rebuilt much of my PC. This has taken so much time and effort that I've overlooked the intermittent internet access probs I've been having. Well, the PC is stable now but the internet probs seem to be getting worse. Mostly it hangs while 'looking up' a new domain name. Often, with for example eBay, Firefox will half render a page so that all the images are missing. These seem to be stored under a different domain - images.ebaystatic.com.

I've tried OpenDNS instead of the default VM ones and that makes no difference.

I've tried Internet Explorer and Firefox - both the same.

I've tried a different router and that makes no difference.

I've tried a different PC and that seems to be better but, since it's on a wireless connection that's a bit dodgy 'cos of some building work we're having done at the moment, it's hard to tell.

I've tried booting from a different partition. Keen followers of the Altis household will remember that one of my hard disks is divided up into a number of partitions and, using System Commander, I can switch between them. Now, here's the oddity - a different partition seems to work well. It's difficult to tell for sure because the problem is intermittent but I'm pretty certain there's a significant difference.

I've scanned my PC with Eset Smart Security and it can't find any probs.

I'm really scratching my head on this one. Here's my HijackThis log - any ideas?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:28:55, on 07/07/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
D:\W2K\System32\smss.exe
D:\W2K\system32\winlogon.exe
D:\W2K\system32\services.exe
D:\W2K\system32\lsass.exe
D:\W2K\system32\Ati2evxx.exe
D:\W2K\system32\svchost.exe
D:\W2K\system32\spoolsv.exe
D:\Program Files\ESET\ESET Smart Security\ekrn.exe
D:\W2K\system32\svchost.exe
D:\W2K\system32\regsvc.exe
D:\W2K\system32\MSTask.exe
D:\W2K\System32\WBEM\WinMgmt.exe
D:\W2K\system32\svchost.exe
D:\W2K\system32\Ati2evxx.exe
D:\W2K\Explorer.EXE
D:\Program Files\WinPortrait\wpctrl.exe
D:\Program Files\ESET\ESET Smart Security\egui.exe
F:\DOWNLOAD\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\W2K\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [PivotSoftware] "D:\Program Files\WinPortrait\wpctrl.exe"
O4 - HKLM\..\Run: [egui] "D:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] D:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\W2K\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\W2K\web\related.htm
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1214334184750
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\W2K\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\W2K\system32\ati2sgag.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\W2K\System32\dmadmin.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - D:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - D:\Program Files\ESET\ESET Smart Security\ekrn.exe

--
End of file - 2747 bytes

[Aragorn]

Can't see much wrong with the HJT log - one remote possibility, check whether there are any other "internat.exe" files, other than in d:\w2k\system32.
If you have an OpenDNS account, can you check the dns lookups after the browser hangs - see whether it was trying to look up the missing domains.
Another long shot - is there any crp in d:\w2k\system32\drivers\etc\hosts ?
What happens if you run an Ubuntu or Fedora live CD for a couple of hours?
HTH

[altis]

Thanks, Aragorn, for passing by.

Originally Posted by Aragorn

Can't see much wrong with the HJT log - one remote possibility, check whether there are any other "internat.exe" files, other than in d:\w2k\system32.

There is another one in d:\w2k\system32\dllcache but this appears identical (same size and date).

Originally Posted by Aragorn

If you have an OpenDNS account, can you check the dns lookups after the browser hangs - see whether it was trying to look up the missing domains.

I don't have an account - looking into that now.

Originally Posted by Aragorn

Another long shot - is there any crp in d:\w2k\system32\drivers\etc\hosts ?

This seems fine. It only has: 127.0.0.1 localhost.

Originally Posted by Aragorn

What happens if you run an Ubuntu or Fedora live CD for a couple of hours?

Dunno!!!

I get this aaaaaaaaaaaaaaall the time. Pages not loading, pages loading with no images, pages hanging.
I know VM have supposedly cancelled all proxies, I know.
But, and I will video it if anyone doesn't believe me(!), if when this happens, I change to a renfrew proxy, everything, and I mean everything is perfectly spot on.
So much so, I don't use Manchester any more. It just doesn't work for me.
Next time it happens, try renf-cache-9.server.ntli.net & port 8080.
I'd be interested to see if it works for you as it does for me.

[altis]

http://www.all-nettools.com/toolbox/proxy-test.php

...reveals that a proxy server is NOT detected.

I get:

Proxy server detected
You came from 86.1.***.*** (**********.bagu.broadband.ntl.com)
Remote address: 62.252.128.28 (renf-cache-9.server.ntli.net)
Remote host: 62.252.128.28 (renf-cache-9.server.ntli.net)

Shame. Works a treat for me.

[altis]

What I meant was that I wasn't using any proxy - Manchester or otherwise.

Anyway, I've tried using Renfrew now and we'll see how we go.

Originally Posted by altis

What I meant was that I wasn't using any proxy - Manchester or otherwise.

No, I don't either unless I specify Renfrew.

[altis]

Well, well, well!

That seems to have sorted it. Well done Kryogenic.

Without it, my internet access is so unreliable as to be unusable - without a considerable amount of patience. Seems like Baguley is totally borked at the moment - and not a mention on the VM status page!

http://status-cable.virginmedia.com/vmstatus/summary.do

Oh, wonderful.

Glad it works for you!
Bear in mind, I do occasionally have to flirt 'tween the two.

Nice one.

[altis]

Well, I've finally got this one cracked - I think.

Even after setting up a list of 11 DNS servers, I was still getting many problems with Firefox 'looking up xxx.xxx' unless I used a proxy. Finding one of these that still worked was an endless game of chase!

Curiously, I could often still use my router, and even nslookup, to lookup URLs but Firefox kept complaining.

As a last resort, before a full Windows reinstall, I tried uninstalling NOD32. Bingo! Seems to work fine all the time now - touch wood. And my PC is a whole lot faster.

So that's another piece of software consigned to the bin.